CVE-2026-54621

Unsanitized carriage returns in GraphQL descriptions allow code injection.

• CVSS 7.8
• 94
• Input Validation and Sanitization
• Local

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.

CVE

CVE-2026-54621

CWE

94

CVSS base score

7.8

Published

2026-07-28

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

datamodel-co

Fixed by upgrading

Yes

Solution

Upgrade `datamodel-code-generator` to version 0.60.1 or later.

import jinja2
from typing import Union

# This example simulates the code generation logic from datamodel-code-generator.
# The template is based on src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2
TEMPLATE = """\
from typing import Union

# GraphQL Union Description:
# {{ description }}

class GeneratedModel:
    field: Union[int, str]
"""

def generate_code_from_schema(description: str) -> str:
    """
    Generates Python code for a data model based on a schema.
    The description from the schema is rendered into a comment.
    """
    env = jinja2.Environment()
    template = env.from_string(TEMPLATE)
    # VULNERABLE: The description is rendered without sanitizing newlines,
    # allowing an attacker-controlled string to inject code into the generated file.
    return template.render(description=description)

import jinja2
from typing import Union

# This example simulates the code generation logic from datamodel-code-generator.
# The template is based on src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2
TEMPLATE = """\
from typing import Union

# GraphQL Union Description:
# {{ description }}

class GeneratedModel:
    field: Union[int, str]
"""

def generate_code_from_schema(description: str) -> str:
    """
    Generates Python code for a data model based on a schema.
    The description from the schema is rendered into a comment.
    """
    env = jinja2.Environment()
    template = env.from_string(TEMPLATE)
    # FIX: Each newline in the description is replaced with a newline followed
    # by a comment character, preventing injection of executable code.
    safe_description = description.replace('\n', '\n# ')
    return template.render(description=safe_description)

type TypeA {
  fieldA: String
}

type TypeB {
  fieldB: Int
}

"""
This is a description.
import os; os.system('echo VULNERABLE') #
"""
union MyUnion = TypeA | TypeB

@misc{vaitp:cve202654621,
  title        = {{Unsanitized carriage returns in GraphQL descriptions allow code injection.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54621},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54621/}}
}